Your smart home device could be a threat to our elections

Data from IoT devices—someone entering a building, driving, using a sink or coffee machine—could make all of us more susceptible to highly targeted spear-phishing attacks.

Your smart home device could be a threat to our elections
[Source images: bensib/iStock; Derek Brumby/IStock]

The app failure that led to a chaotic 2020 Iowa caucus was a reminder of how vulnerable the democratic process is to technological problems—even without any malicious outside intervention. Far more sophisticated foreign hacking continues to try to disrupt democracy, as a rare joint federal agency warning advised prior to Super Tuesday. Russia’s attempt to interfere in the 2016 election has already revealed how this could happen: social media disinformation, email hacking, and probing of voter registration systems.


The threats to the 2020 election may be even more insidious. As I explain in my new book, The Internet in Everything: Freedom and Security in a World with No Off Switch, election interference may well come through the vast constellation of always-on, always-connected cameras, thermostats, alarm systems, and other physical objects collectively known as the “internet of things.”

The social and economic benefits of these devices are tremendous. But, in large part, because the devices are not yet adequately secure, they also raise concerns for consumer safety, national security, and privacy. And they create new vulnerabilities for democracy.


Disrupting political communication

Connected objects have already been hijacked to shut down internet traffic.




Preventing people from voting


Smart cities and the industrial internet of things are already targets, as evidenced by the yearslong history of Russia-attributed disruptions to Ukrainian power systems. Hacking home alarm or water systems could create politically microtargeted local emergencies that distract people who would otherwise vote.


Making phishing hacks more credible

The massive amount of intimate data these devices collect—when someone enters a building, drives a car, uses a sink, or turns on a coffee machine—could also make political operatives more susceptible to highly targeted spear-phishing attacks. These tactics trick people into relinquishing personal information or clicking on malicious links—mistakes that gave hackers access to Democratic National Committee emails in 2016.

Similar phishing attempts on political campaigns continue, seeking to infiltrate email accounts used by presidential and down-ballot candidates. The more believable they are, the more effective they are—so an email referencing personal facts gleaned from connected objects would make these attacks more potent.

Not being surprised again

More things than people are now connected to the internet. These connected objects are new terrain for election interference—and people shouldn’t be surprised if they’re used that way.


To address this over the long term, customers will have to demand better privacy and security from their connected devices, such as doorbells and light bulbs. Companies—and political institutions—that connect these devices to their networks will have to build in appropriate safeguards. Manufacturers will also have to design better protections into their devices. There may also need to be data privacy laws limiting how personal information is collected and shared.

More immediately, though, it is essential not only for state and local authorities and intelligence communities to remain vigilant but for citizens to take security precautions with their own devices and be on high alert for personalized attempts to influence or disrupt their political participation.

Preserving democracy now requires taking seriously the consequences of the internet being deeply embedded in the physical world—the internet in everything. We are all responsible.

Laura DeNardis is a professor of communication studies at American University School of Communication.


The Conversation